PHP2Shell: The Critical PHP Vulnerability and What to Do Now
Two critical PHP flaws let attackers take over web servers without logging in. Here is who is affected, how to check your PHP version and how to fix it.
On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". Attacks were seen the same day, and on 26 October the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its catalogue of vulnerabilities known to be exploited.
If your website or web app runs on PHP, and that includes most WordPress, WooCommerce, Laravel, Drupal and Magento sites, this affects you. This guide explains what happened in plain language and what to do today.
This is a developing situation. This article reflects what was publicly known on 27 October 2026.
What is PHP2Shell?
PHP is the programming language that runs on the server behind a large share of the web. PHP2Shell is a pair of bugs in PHP itself, not in a plugin or theme, which means a website can be vulnerable even if its own code is perfectly written.
Both flaws allow unauthenticated remote code execution. In plain terms, an attacker who can reach your website over the internet can run their own commands on your server, without a username or password. They are rated 9.2 out of 10 for severity (CVSS v4.0).
- CVE-2026-109618 is triggered when PHP runs out of memory part-way through setting up a request, leaving data in a broken state that PHP later trusts.
- CVE-2026-109619 involves internal data that outlives the request it belongs to, so the next request handled by the same PHP process can act on leftover data.
According to the PHP project, the risk is highest on servers using Apache with mod_php, where an attack can succeed before your application's code even runs.
Why it matters for your business
Code execution on your server means an attacker can potentially:
- read or steal customer data, orders and passwords stored in your database
- change your website, add spam pages or redirect visitors to malicious sites
- install malware or use your server to attack others
- take your site offline
Beyond the immediate damage, a breach can mean lost sales, a drop in search rankings if Google flags your site, and data-protection obligations if personal data is exposed.
Is my website affected?
Every PHP installation that serves web requests is in scope, whatever the server setup: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP.
| PHP version | Status |
|---|---|
| 8.5 | Fixed in 8.5.12 |
| 8.4 | Fixed in 8.4.27 |
| 8.3 | Fixed in 8.3.36 |
| 8.2 | Fixed in 8.2.35 |
| 7.4, 8.0, 8.1 | No official release. Only source patches, Linux distribution or long-term-support vendor packages |
| 7.3 and older (including PHP 5) | Affected, no fix |
If you are below the fixed version for your branch, you are vulnerable until you update.
How to check your PHP version
Use whichever applies to you:
- WordPress: go to Tools → Site Health → Info → Server and look at "PHP version".
- Hosting control panel: cPanel, Plesk and most managed hosts show the PHP version under a "PHP" or "Software" section.
- Laravel: run
php artisan abouton the server. - Server access: run
php -v. Note that the command line can use a different PHP than your website, so also check what your web server or PHP-FPM is running.
What to do now
1. Update PHP to a fixed version
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the updated PHP package from your Linux distribution. The PHP maintainers state that no configuration change fully protects you. Updating is the fix.
2. Restart PHP after updating
Running PHP processes keep using the old code until they restart. Restart PHP-FPM, Apache and any long-running PHP workers so the fix actually takes effect.
3. If you use managed or shared hosting
Many hosts update PHP for you, but don't assume. Contact your host and ask two questions: Has PHP been updated to a fixed version for PHP2Shell? and Have PHP processes been restarted? If your site is pinned to an old PHP version in the control panel, the host may not be able to protect it.
4. If you are on PHP 8.1 or older
These versions no longer receive official updates. CISA's advice is to take unsupported PHP systems offline until they can be updated. The lasting fix is to upgrade to a supported version (8.2 or newer). For older WordPress or Laravel sites this can mean updating plugins, themes or framework versions too, so test on a copy of the site first.
5. If you can't update today
- Restrict access to the site or server (for example, behind a VPN or IP allow-list) or take it offline temporarily.
- A web application firewall (such as Cloudflare's) can block known attack patterns, but it is only partial protection while you patch, not a replacement for it.
6. Check for signs of compromise
If your site was exposed before you patched, look for warning signs: unfamiliar files or admin users, PHP processes launching shell commands or downloading tools, unexpected outbound traffic, or changed pages. If anything looks wrong, restore from a clean backup, change all passwords and keys stored on the server, and get a professional to investigate.
The bigger lesson: keep your stack up to date
PHP2Shell isn't a reason to abandon PHP. It is a reminder that every website runs on layers of software that need regular maintenance. Sites still on PHP 7.4 or 8.1 are now in the hardest position, because there is no simple official update for them.
A simple routine prevents most of this:
- stay on a supported PHP version and plan upgrades before end-of-life dates
- apply security updates promptly and know who is responsible for them (you, your developer or your host)
- keep regular, tested backups stored away from the server
- keep plugins, themes and frameworks current
Need help?
If you're not sure whether your site is affected, or you're stuck on an old PHP version that needs upgrading, get in touch with us. We build and maintain custom web applications and websites and can help you update safely.